Junos lo0.0 filter

First, we'll setup some handy prefix-lists we'll use in the filters.

set policy-options prefix-list v4-router-ifl apply-path "interfaces <*> unit <*> family inet address <*>"
set policy-options prefix-list v6-router-ifl apply-path "interfaces <*> unit <*> family inet6 address <*>"
set policy-options prefix-list v4-bgp-peers apply-path "protocols bgp group <*> neighbor <*>"
set policy-options prefix-list v4-ipip-peers apply-path "interfaces <ip-*> unit <*> tunnel destination <*>"
set policy-options prefix-list v4-ntp-servers apply-path "system ntp server <*>"
set policy-options prefix-list snmp-client-list apply-path "snmp client-list <*> <*>"
set policy-options prefix-list ospf 224.0.0.5/32
set policy-options prefix-list ospf 224.0.0.6/32
set policy-options prefix-list v4-mcast-all-routers 224.0.0.2/32
set policy-options prefix-list localhost 127.0.0.0/8
set policy-options prefix-list trusted <management-lan>/24
set policy-options prefix-list trusted <lo0.0 address>/32
set policy-options prefix-list trusted 127.0.0.0/8
set policy-options prefix-list vpn-peers apply-path "security ike gateway <*> address <*>"
set policy-options prefix-list v4-dns-servers apply-path "system name-server <*>"

Setup some policers.

set firewall policer manage-1m apply-flags omit
set firewall policer manage-1m if-exceeding bandwidth-limit 1m
set firewall policer manage-1m if-exceeding burst-size-limit 625k
set firewall policer manage-1m then discard
set firewall policer manage-5m apply-flags omit
set firewall policer manage-5m if-exceeding bandwidth-limit 5m
set firewall policer manage-5m if-exceeding burst-size-limit 625k
set firewall policer manage-5m then discard

Next, we'll put together the filters.

set firewall family inet filter bad-frags apply-flags omit
set firewall family inet filter bad-frags term bad-frags from is-fragment
set firewall family inet filter bad-frags term bad-frags from protocol icmp
set firewall family inet filter bad-frags term bad-frags then count bad-frags
set firewall family inet filter bad-frags term bad-frags then discard

set firewall family inet filter ok-ospf apply-flags omit
set firewall family inet filter ok-ospf term ok-ospf from source-prefix-list v4-router-ifl
set firewall family inet filter ok-ospf term ok-ospf from destination-prefix-list v4-router-ifl
set firewall family inet filter ok-ospf term ok-ospf from destination-prefix-list ospf
set firewall family inet filter ok-ospf term ok-ospf from protocol ospf
set firewall family inet filter ok-ospf term ok-ospf then accept

set firewall family inet filter ok-igmp apply-flags omit
set firewall family inet filter ok-igmp term ok-igmp from protocol igmp
set firewall family inet filter ok-igmp term ok-igmp then accept

set firewall family inet filter ok-bgp apply-flags omit
set firewall family inet filter ok-bgp term ok-bgp from source-prefix-list v4-bgp-peers
set firewall family inet filter ok-bgp term ok-bgp from protocol tcp
set firewall family inet filter ok-bgp term ok-bgp from port bgp
set firewall family inet filter ok-bgp term ok-bgp then accept

set firewall family inet filter ok-ntp apply-flags omit
set firewall family inet filter ok-ntp term ok-ntp from source-prefix-list v4-ntp-servers
set firewall family inet filter ok-ntp term ok-ntp from source-prefix-list localhost
set firewall family inet filter ok-ntp term ok-ntp from protocol udp
set firewall family inet filter ok-ntp term ok-ntp from port ntp
set firewall family inet filter ok-ntp term ok-ntp then accept

set firewall family inet filter ok-snmp apply-flags omit
set firewall family inet filter ok-snmp term ok-snmp from source-prefix-list snmp-client-list
set firewall family inet filter ok-snmp term ok-snmp from protocol udp
set firewall family inet filter ok-snmp term ok-snmp from port snmp
set firewall family inet filter ok-snmp term ok-snmp then accept

set firewall family inet filter ok-ssh apply-flags omit
set firewall family inet filter ok-ssh term ok-ssh from source-prefix-list trusted
set firewall family inet filter ok-ssh term ok-ssh from protocol tcp
set firewall family inet filter ok-ssh term ok-ssh from port ssh
set firewall family inet filter ok-ssh term ok-ssh then accept

set firewall family inet filter ok-netconf apply-flags omit
set firewall family inet filter ok-netconf term ok-netconf from source-prefix-list trusted
set firewall family inet filter ok-netconf term ok-netconf from protocol tcp
set firewall family inet filter ok-netconf term ok-netconf from port 830
set firewall family inet filter ok-netconf term ok-netconf then accept

set firewall family inet filter ok-ike apply-flags omit
set firewall family inet filter ok-ike term ok-ike from source-prefix-list vpn-peers
set firewall family inet filter ok-ike term ok-ike from protocol udp
set firewall family inet filter ok-ike term ok-ike from port 500
set firewall family inet filter ok-ike term ok-ike then accept

set firewall family inet filter ok-esp apply-flags omit
set firewall family inet filter ok-esp term ok-esp from source-prefix-list vpn-peers
set firewall family inet filter ok-esp term ok-esp from protocol esp
set firewall family inet filter ok-esp term ok-esp then accept

set firewall family inet filter ok-icmp apply-flags omit
set firewall family inet filter ok-icmp term ok-icmp from protocol icmp
set firewall family inet filter ok-icmp term ok-icmp from icmp-type echo-reply
set firewall family inet filter ok-icmp term ok-icmp from icmp-type echo-request
set firewall family inet filter ok-icmp term ok-icmp from icmp-type time-exceeded
set firewall family inet filter ok-icmp term ok-icmp from icmp-type unreachable
set firewall family inet filter ok-icmp term ok-icmp from icmp-type source-quench
set firewall family inet filter ok-icmp term ok-icmp from icmp-type router-advertisement
set firewall family inet filter ok-icmp term ok-icmp from icmp-type parameter-problem
set firewall family inet filter ok-icmp term ok-icmp then policer manage-5m
set firewall family inet filter ok-icmp term ok-icmp then count ok-icmp
set firewall family inet filter ok-icmp term ok-icmp then accept

set firewall family inet filter ok-traceroute apply-flags omit
set firewall family inet filter ok-traceroute term ok-udp-traceroute from protocol udp
set firewall family inet filter ok-traceroute term ok-udp-traceroute from ttl 1
set firewall family inet filter ok-traceroute term ok-udp-traceroute from destination-port 33435-33450
set firewall family inet filter ok-traceroute term ok-udp-traceroute then policer manage-1m
set firewall family inet filter ok-traceroute term ok-udp-traceroute then count ok-udp-traceroute
set firewall family inet filter ok-traceroute term ok-udp-traceroute then accept
set firewall family inet filter ok-traceroute term ok-icmp-traceroute from protocol icmp
set firewall family inet filter ok-traceroute term ok-icmp-traceroute from ttl 1
set firewall family inet filter ok-traceroute term ok-icmp-traceroute from icmp-type echo-request
set firewall family inet filter ok-traceroute term ok-icmp-traceroute from icmp-type timestamp
set firewall family inet filter ok-traceroute term ok-icmp-traceroute from icmp-type time-exceeded
set firewall family inet filter ok-traceroute term ok-icmp-traceroute then policer manage-1m
set firewall family inet filter ok-traceroute term ok-icmp-traceroute then count ok-icmp-traceroute
set firewall family inet filter ok-traceroute term ok-icmp-traceroute then accept

set firewall family inet filter ok-dhcp apply-flags omit
set firewall family inet filter ok-dhcp term ok-dhcp from protocol udp
set firewall family inet filter ok-dhcp term ok-dhcp from source-port 67
set firewall family inet filter ok-dhcp term ok-dhcp from source-port 68
set firewall family inet filter ok-dhcp term ok-dhcp from destination-port 67
set firewall family inet filter ok-dhcp term ok-dhcp from destination-port 68
set firewall family inet filter ok-dhcp term ok-dhcp then count ok-dhcp
set firewall family inet filter ok-dhcp term ok-dhcp then accept

set firewall family inet filter ok-bfd apply-flags omit
set firewall family inet filter ok-bfd term ok-bfd from protocol udp
set firewall family inet filter ok-bfd term ok-bfd from source-port 49152-65535
set firewall family inet filter ok-bfd term ok-bfd from destination-port 3784-3785
set firewall family inet filter ok-bfd term ok-bfd then count ok-bfd
set firewall family inet filter ok-bfd term ok-bfd then accept

set firewall family inet filter ok-dns apply-flags omit
set firewall family inet filter ok-dns term ok-dns from source-prefix-list v4-dns-servers
set firewall family inet filter ok-dns term ok-dns from protocol udp
set firewall family inet filter ok-dns term ok-dns from source-port 53
set firewall family inet filter ok-dns term ok-dns then policer manage-1m
set firewall family inet filter ok-dns term ok-dns then count ok-dns
set firewall family inet filter ok-dns term ok-dns then accept

set firewall family inet filter ok-established apply-flags omit
set firewall family inet filter ok-established term ok-established from protocol tcp
set firewall family inet filter ok-established term ok-established from tcp-established
set firewall family inet filter ok-established term ok-established then accept


Next, let's put the modules into filters we'll actually apply to the loopback.

set firewall family inet filter common-services apply-flags omit
set firewall family inet filter common-services term ok-dhcp filter ok-dhcp
set firewall family inet filter common-services term bad-frags filter bad-frags
set firewall family inet filter common-services term ok-icmp filter ok-icmp
set firewall family inet filter common-services term ok-traceroute filter ok-traceroute
set firewall family inet filter common-services term ok-ntp filter ok-ntp
set firewall family inet filter common-services term ok-snmp filter ok-snmp
set firewall family inet filter common-services term ok-ssh filter ok-ssh
set firewall family inet filter common-services term ok-netconf filter ok-netconf
set firewall family inet filter common-services term ok-dns filter ok-dns
set firewall family inet filter common-services term ok-established filter ok-established

set firewall family inet filter igp apply-flags omit
set firewall family inet filter igp term ok-ospf filter ok-ospf
set firewall family inet filter igp term ok-igmp filter ok-igmp

set firewall family inet filter peering apply-flags omit
set firewall family inet filter peering term ok-ike filter ok-ike
set firewall family inet filter peering term ok-esp filter ok-esp
set firewall family inet filter peering term ok-bfd filter ok-bfd
set firewall family inet filter peering term ok-bgp filter ok-bgp

set firewall family inet filter discard-all apply-flags omit
set firewall family inet filter discard-all term all then discard

Now, apply that to your lo0.0:

set interfaces lo0 unit 0 family inet filter input-list common-services
set interfaces lo0 unit 0 family inet filter input-list igp
set interfaces lo0 unit 0 family inet filter input-list peering
set interfaces lo0 unit 0 family inet filter input-list discard-all
set interfaces lo0 unit 0 family inet address <lo0.0 address>/32